Paolo Masci

A generation of interoperable devices is emerging in control systems. Devices can be controlled by users at multiple levels. The devices that are controlled may be certified as safe by their vendors, but new issues may arise from their integration and remote use, as new interaction pathways will be enabled that are simply not possible when the device is used as a stand-alone system. This paper is concerned with modelling concrete interfaces that are designed to enable use of these systems. It builds on previous work concerned with proving use-centred safety properties across the interoperable system. The concern of this paper however is describing the relationship between an abstract model and a concrete interface that reflects more concretely the tasks that the users are intended to perform. In the example used in this paper, a menu interface is built on top of the abstract interface. The primary concern of the paper is describing the relationship between the abstract interface and the specified concrete interface. Properties of the interface that were discussed in previous work are proved of the concrete interface. This paper uses, as an example, use-centred safety properties of integrated clinical environments for remote medical care. Four properties are considered briefly: consistency , completeness , feedback and reversibility with an understanding of the tasks that users may perform. More detail will be given to the first two with a particular focus on the relation between the abstract interaction model and a concrete menu based model. The properties are formalised in the language of the PVS verification system. They are mechanically verified using the PVS proof assistant for a model of a realistic prototype of an integrated clinical environment. The presented analysis is intended to be performed during system design and development, and before the actual system is deployed, to increase confidence that the design complies with important use-centred safety properties that capture design guidelines discussed in usability engineering standards. It is envisaged that such an analysis could help inform a safety assessment of the integrated system.

Small round-off errors in safety-critical systems can lead to catastrophic consequences. In this context, determining if the result computed by a floating-point program is accurate enough with respect to its ideal real-number counterpart is essential. This paper presents PRECiSA 4.0, a tool that rigorously estimates the accumulated round-off error of a floating-point program. PRECiSA 4.0 combines static analysis, optimization techniques, and theorem proving to provide a modular approach for computing a provably correct round-off error estimation. PRECiSA 4.0 adds several features to previous versions of the tool that enhance its applicability and performance. These features include support for data collections such as lists, records, and tuples; support for recursion schemas; an updated floating-point formalization that closely characterizes the IEEE-754 standard; an efficient and modular analysis of function calls that improves the performances for large programs; and a new user interface integrated into Visual Studio Code.

This article reports on the development of usability engineering recommendations for next-generation integrated interoperable medical devices. A model-based hazard analysis method is used to reason about possible design anomalies in interoperability functions that could lead to use errors. Design recommendations are identified that can mitigate design problems. An example application of the method is presented based on an integrated medical system prototype for postoperative care. The AAMI/UL technical committee used the results of the described analysis to inform the creation of the Interoperability Usability Concepts, Annex J, which is included in the first edition of the new ANSI/AAMI/UL 2800-1:2019 standard on medical device interoperability. The presented work is valuable to experts developing future revisions of the interoperability standard, as it documents key aspects of the analysis method used to create part of the standard. The contribution is also valuable to manufacturers, as it demonstrates how to perform a model-based analysis of use-related aspects of a medical system at the early stages of development, when a concrete implementation of the system is not yet available.